CVE-2026-3300: Critical WordPress Plugin Flaw Actively Exploited — 29,300 Attack Attempts Blocked

The vulnerability exists in the Calculation Addon's process_filter() function, which concatenates user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters.

In plain English — your contact form takes whatever a visitor types and, in certain configurations, runs it as computer code on your server. Normally the plugin tries to clean up dangerous input before doing this. But this cleaning process has a gap — it does not remove a specific type of character that PHP uses to break out of expected code context and execute entirely new commands.

An attacker exploiting this flaw does not need an account on your site. They do not need to know your password. They simply visit any page on your site that has a form using the Complex Calculation feature, type a specially crafted value into any text field — even an email field or a dropdown — and submit it. Your server then executes the attacker's code as if it were your own.

Successful exploitation grants attackers arbitrary PHP code execution on the target server, providing complete control over the WordPress installation and underlying server environment. Attackers can create administrative users, modify site content, steal sensitive data, install backdoors, or pivot to other systems on the network.

The flaw was reported to Wordfence's bug bounty program by a researcher using the handle h0xilo, and WPEverest patched the flaw in version 1.9.13. The patch was released on March 18, 2026 — nearly two months before the current article. The fact that thousands of sites are still being attacked means thousands of site owners have not yet applied an available fix. This is the most avoidable category of cyberattack: a known vulnerability with a known patch that simply has not been installed.

For Indian website owners — particularly small businesses, bloggers, educational institutions, and e-commerce operators using WordPress — this vulnerability is directly relevant. WordPress is by far the most popular website platform in India. Everest Forms Pro is a widely used commercial plugin for building contact forms, inquiry forms, and booking forms on Indian business websites.

A compromised WordPress site does not just affect the site owner. It means your visitors' contact information, inquiry details, and any data entered into your forms can be stolen. It means your site can be turned into a platform for distributing malware to your visitors without your knowledge. It means your domain's reputation can be permanently damaged if Google flags your site as dangerous in search results. For e-commerce sites, it means customer payment data is at risk.

The 29,300 blocked attack attempts represent only the attacks caught by sites protected by Wordfence. Unprotected sites running the vulnerable plugin have no visibility into whether they have been targeted or compromised.